Sending syslog from Linux systems into Graylog
Other Solutions
How to send syslog from Linux systems into Graylog
Published
30 Nov 07:05
Last Push
06 Nov 07:01
Marketplace Rating
Discussion
4 Comments
Your Rating
Please sign in to rate this add-on.
Comments
for those who read this.
0x23marco.
The server "graylog.example.org" will not resolve, and syslog-ng will balk when it attempts to set up the forwarding to a non-existent IP address. Set it to a hostname that you are certain will resolve and will not change frequently.
Regarding the syslog-ng configuration I experienced an error not sure how to resolve.
Restart syslog-ng throws an exception: "Starting syslog servicessyntax error at X" that's this syslog("graylog.example.org" port(514));
Any hints where the syntax error is?
thanks
Just to mention that currently only legacy rsyslog syntax is documented,
the more modern approach would be:
action(type="omfwd" target="127.0.0.1" port="10514" template="RSYSLOG_SyslogProtocol23Format")
Please sign in to comment.
On my Debian 9.9 system, syslog-ng v3.8, I had to change "syslog("[graylog_IP]" port(514));" to udp("[graylog_IP]" port(514));" to get it to work. Not sure where the syslog() function is defined, but maybe it defaults to using tcp? In Graylog, my Input was set to Syslog UDP too.